Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Cognito setup and abuse V-020
Checks user pool settings such as self sign-up and MFA, and finds abuse of identity pools.
Checks
| Checks | Needs |
|---|---|
| Checks that no user pool lets anyone sign up without verifying their email or phone. | cognito pool |
| Checks that every user pool offers a second factor. | cognito pool |
| Checks that no user pool accepts passwords shorter than eight characters. | cognito pool |
| Checks that no app client lets the password be sent to the service. | cognito pool |
| Checks that no app client tells a caller which users exist. | cognito pool |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1078.004 T1136.003
How to fix
LookupEvents replay for the scope, warden show (receipt) → raise the budget, fix delegation or the spoke trust by PR; read-only